Rand Mutual Assurance says it is investigating a possible compromise of its systems after a threat actor advertised data it claims to have taken from the South African insurer. The company has not confirmed a breach, and says it does not yet know whether any personal information was accessed.

What happened

RMA received an alert about a possible systems breach on Friday 23 October and put specialist teams on the investigation. The insurer's statement to ITWeb says it is still working out the nature and extent of the incident, and will communicate once the facts are established.

Separately, a threat actor posted on an underground forum claiming to hold 366GB taken from RMA, described as 1,683,810 claims records and 593,786 files, with a demand of $95,000 and a 5 November deadline before publication. Dark Web Intelligence, which flagged the post, states that the claims are unverified and do not confirm a breach.

Who is affected

On the current evidence, the exposure sits with RMA's claims population: injured workers and occupational disease claimants whose files would hold identity numbers, medical detail and banking information.

• RMA claimants and policyholders whose claims files sit in the insurer's systems
• Employers and brokers who submit claims on their behalf and hold copies of the same data
• Any South African organisation holding similar compensation or medical claims records, which are among the richest identity datasets in the country

What to do now

Treat this as unconfirmed but plan as if the records are out. The pattern is familiar: a claim appears, the organisation confirms an investigation, and the leak decision lands on a date. The window between those two points is when controls should be checked, not after a regulator or a claimant asks.

• Confirm whether your organisation shares claims or HR data with RMA and where those copies live
• Ask your broker or RMA contact for the official position in writing rather than relying on forum claims
• Pre-emptively tighten monitoring on any account that holds identity numbers and banking detail
• If you process similar records, confirm your Information Officer is registered and your breach response plan has an owner and a contact list

What this means for South African businesses

This is the fourth insurance-sector data story in a chain that started with the June compromise at technology provider MIP Holdings, and it shows how far one supplier incident travels. For an SME the lesson is not about RMA specifically: it is that claims, medical and payroll records you hand to a third party remain your POPIA problem when that third party is breached. Most small firms in this position have never tested who would make the call, notify the Regulator and contact data subjects within the required window.

Source: ITWeb - Rand Mutual probes alleged breach of 1.68m claims

Also on the blog

• Microsoft Authenticator CVE-2026-80097: any Android app could pull your work tokens
• Fake IT support on Teams: 400+ incidents, payload running in under 15 minutes

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.